bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

Reason

Machine shutdown

General

Target

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
Size

17KB
MD5

1f54db8e2133f535609b3eda1db7d869
SHA1

32a038fd9fc7acca9886e54c860949d0b3a93599
SHA256

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9
SHA512

df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b
SSDEEP

384:/AhgmZnWs/FBSPGvBm/Qbw7gZTErM/JtnObH0/RtDlFjBsEu:/2gB7GpmaH/JQL0/rC

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

x2z8.exex2z8.exe

pid process

1712 x2z8.exe
916 x2z8.exe

pid	process
1712	x2z8.exe
916	x2z8.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/536-54-0x0000000000400000-0x0000000000411000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
behavioral1/memory/1712-68-0x0000000000400000-0x0000000000411000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx

Deletes itself 1 IoCs

Processes:

x2z8.exe

pid process

916 x2z8.exe

pid	process
916	x2z8.exe

Loads dropped DLL 3 IoCs

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

pid	process
748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
1712	x2z8.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
File opened for modification	\??\PHYSICALDRIVE0	x2z8.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	pid	process	target process
PID 536 set thread context of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 1712 set thread context of 916	1712	x2z8.exe	x2z8.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

x2z8.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	916	x2z8.exe
Token: 33	1220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1220	AUDIODG.EXE
Token: 33	1220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1220	AUDIODG.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exebd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	pid	process	target process
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 536 wrote to memory of 748	536	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 748 wrote to memory of 1712	748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 748 wrote to memory of 1712	748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 748 wrote to memory of 1712	748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 748 wrote to memory of 1712	748	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe
PID 1712 wrote to memory of 916	1712	x2z8.exe	x2z8.exe

C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
"C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\x2z8.exe
C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\x2z8.exe
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
4⤵
- Executes dropped EXE
- Deletes itself
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2016

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fpath.txt
Filesize
102B

MD5
3afbf70daa7e058bea4db2e3a2ad36c4

SHA1
748df8998d66d59d4277c8b1e1b8e729bd14f694

SHA256
03a7b531eced0db2b1960d8ae4271829912b2fe3a4d4519358995cc299042d36

SHA512
14524f55f1defadc8da6c3d9ccffffeb99de9647eb88d3bbcbf60fa9d19a4ad61052c7808c1fd40027d9b6291c59ad643e444bbe27d953464e78b0da455651d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
memory/536-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/748-59-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/748-66-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/748-62-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/748-60-0x0000000000401600-mapping.dmp

Download
memory/748-57-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/748-56-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/748-55-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/916-76-0x0000000000401600-mapping.dmp

Download
memory/916-81-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1712-65-0x0000000000000000-mapping.dmp

Download
memory/1712-68-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1756-82-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads